CVE-2026-72231 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: avoid request storms during pending request
batadv_send_tt_request() allocates a tt_req_node when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time to an originator.
But if allocation of the send buffer failed, this request must be cleaned up again. But indicator for such a failure is "ret == false". But the actual implementation is checking for "ret == true".
The check must be inverted to not loose the information about the TT request directly after it was attempted to be sent out. This should avoid potential request storms.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the batman-adv kernel module, which implements the B.A.T.M.A.N. routing protocol for wireless mesh networks. This specific issue resides within the translation table (TT) handling mechanism where the system manages requests for topology information between nodes in the mesh network. The flaw manifests in the batadv_send_tt_request() function which is responsible for sending translation table requests to destination originator nodes, a critical operation for maintaining network connectivity and routing decisions.
The technical implementation contains a logical error in conditional logic that governs cleanup procedures when transmission buffer allocation fails. When the function attempts to send a TT request but encounters memory allocation issues, it should properly clean up the allocated tt_req_node structure to prevent duplicate requests. However, due to incorrect boolean comparison logic where the code checks "ret == true" instead of "ret == false", the cleanup process fails when allocation errors occur. This logical inversion causes the system to retain references to pending TT request structures even after failed transmission attempts.
The operational impact of this vulnerability creates a condition where multiple TT requests can accumulate in memory without proper cleanup, leading to potential request storms that flood the network with unnecessary traffic. This behavior directly violates the intended design principle of preventing concurrent TT requests to the same originator node, which is fundamental to maintaining network stability and avoiding resource exhaustion. The vulnerability essentially allows for a denial-of-service condition where network resources become consumed by redundant request processing rather than legitimate routing operations.
From a cybersecurity perspective, this issue falls under CWE-691, which addresses insufficient control flow management and improper handling of error conditions. The problem also relates to ATT&CK technique T1498, specifically focusing on resource exhaustion attacks through excessive network traffic generation. The vulnerability represents a classic case of inadequate error handling that can be exploited to cause network performance degradation or complete service disruption in mesh network environments where batman-adv is deployed.
The recommended mitigation involves correcting the conditional logic in the batadv_send_tt_request() function to properly check for "ret == false" when determining whether cleanup procedures should execute after failed buffer allocation. This ensures that tt_req_node structures are properly deallocated when transmission attempts fail, preventing the accumulation of pending requests that could lead to request storms. Additionally, implementing proper memory management practices with bounded resource allocation and monitoring for excessive TT request generation would provide additional defense-in-depth measures against similar issues in the mesh network infrastructure.